Multiple license assigned ( WITH / OR ) operator

[bloobsky]

When an SBOM contains a license expression using the SPDX WITH operator
(e.g. Apache-2.0 WITH LLVM-exception), grant fails to look it up and logs:

linux-raw-sys 0.12.1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT Unknown

Grant logs ERROR unable to get license by ID: Apache-2.0 WITH LLVM-exception
on every affected component and treats the expression as unresolvable.

[kzantow]

Do you have an image, SBOM, or other source to scan that we could use to show this problem?

[bloobsky]

Sorry for delay on this one,

{ "bom-ref": "pkg:cargo/linux-raw-sys@0.12.1?package-id=pkg%3Acargo%2Flinux-raw-sys%400.12.1%3Fpackage-id%3D7fa7c8e99aec83c7", "type": "library", "name": "linux-raw-sys", "version": "0.12.1", "licenses": [ { "expression": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT" } ], "cpe": "cpe:2.3:a:linux-raw-sys:linux-raw-sys:0.12.1:*:*:*:*:*:*:*", "purl": "pkg:cargo/linux-raw-sys@0.12.1", "externalReferences": [ { "url": "registry+https://github.com/rust-lang/crates.io-index", "type": "distribution" } ], "properties": [ { "name": "syft:package:foundBy", "value": "rust-cargo-lock-cataloger" }, { "name": "syft:package:language", "value": "rust" }, { "name": "syft:package:type", "value": "rust-crate" }, { "name": "syft:package:metadataType", "value": "rust-cargo-lock-entry" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux-raw-sys:linux_raw_sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux_raw_sys:linux-raw-sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux_raw_sys:linux_raw_sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux-raw:linux-raw-sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux-raw:linux_raw_sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux_raw:linux-raw-sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux_raw:linux_raw_sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux:linux-raw-sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:cpe23", "value": "cpe:2.3:a:linux:linux_raw_sys:0.12.1:*:*:*:*:*:*:*" }, { "name": "syft:location:0:path", "value": "/Cargo.lock" } ] }, { "bom-ref": "pkg:cargo/litemap@0.8.2?package-id=pkg%3Acargo%2Flitemap%400.8.2%3Fpackage-id%3D3161e27f7a5e3af2", "type": "library", "name": "litemap", "version": "0.8.2", "licenses": [ { "license": { "id": "Unicode-3.0" } } ], "cpe": "cpe:2.3:a:litemap:litemap:0.8.2:*:*:*:*:*:*:*", "purl": "pkg:cargo/litemap@0.8.2", "externalReferences": [ { "url": "registry+https://github.com/rust-lang/crates.io-index", "type": "distribution" } ], "properties": [ { "name": "syft:package:foundBy", "value": "rust-cargo-lock-cataloger" }, { "name": "syft:package:language", "value": "rust" }, { "name": "syft:package:type", "value": "rust-crate" }, { "name": "syft:package:metadataType", "value": "rust-cargo-lock-entry" }, { "name": "syft:location:0:path", "value": "/Cargo.lock" } ] }, { "bom-ref": "pkg:cargo/lock_api@0.4.14?package-id=pkg%3Acargo%2Flock_api%400.4.14%3Fpackage-id%3Db6694e94aaf8cf51", "type": "library", "name": "lock_api", "version": "0.4.14", "licenses": [ { "expression": "Apache-2.0 OR MIT" } ], "cpe": "cpe:2.3:a:lock_api_project:lock_api:0.4.14:*:*:*:*:rust:*:*", "purl": "pkg:cargo/lock_api@0.4.14", "externalReferences": [ { "url": "registry+https://github.com/rust-lang/crates.io-index", "type": "distribution" } ], "properties": [ { "name": "syft:package:foundBy", "value": "rust-cargo-lock-cataloger" }, { "name": "syft:package:language", "value": "rust" }, { "name": "syft:package:type", "value": "rust-crate" }, { "name": "syft:package:metadataType", "value": "rust-cargo-lock-entry" }, { "name": "syft:location:0:path", "value": "/Cargo.lock" } ] },

[kzantow]

I put this in a scannable SBOM:

% grant list spdx-license-expression-with-clause-unknown.json
 LICENSE                                              PACKAGES  RISK    
 Apache-2.0                                                  1  Low     
 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT         1  Unknown 
 MIT                                                         1  Low     

[bloobsky]

Okay make sense on one I can confirm I got same results,
Here I attach 15 licenses in scannable SBOM and returm me the ERROR from above.

spdx-with-clause-15-packages.cdx.json